Description

Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an unauthorized attacker to execute code locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:53.703Z",
  "pubdate": "2026-08-11T17:18:53.703Z",
  "executiveSummary": "A command injection vulnerability has been identified in Microsoft Office, classified as CWE-77 (Improper Neutralization of Special Elements used in a Command).\nThis security flaw allows an unauthorized local attacker to execute arbitrary code within the context of the current user.\nThe vulnerability affects Microsoft Office and poses significant risk implications regarding local system integrity and confidentiality.\nExploitation requires the execution of locally crafted input or files designed to leverage improper command neutralization within the vulnerable application components.\nSuccessful exploitation grants the attacker the ability to execute system-level or user-level commands, potentially leading to full system compromise depending on the privileges of the affected user session.",
  "technicalDetails": "The root cause of the vulnerability stems from improper neutralization of special characters and elements used in system commands processed by Microsoft Office components.\nThe vulnerable component fails to adequately sanitize or validate user-supplied input or structured data before passing it to underlying operating system command interpreters or shell execution functions.\nThe attack vector involves local exploitation where an unauthorized threat actor induces the application to process maliciously crafted input or files containing injected command sequences.\nDuring the attack flow, the affected Microsoft Office parser or handler encounters special metacharacters that are misinterpreted as command delimiters rather than literal data.\nThis misinterpretation allows the injected payload to break out of the intended data context and execute arbitrary operating system commands with the privileges of the user running the Microsoft Office process.\nAuthentication and network exposure requirements are minimal or non-applicable for the initial local vector, as the flaw relies on local file processing or user interaction with untrusted content.\nPrivilege requirements are constrained by the access level of the targeted user running the vulnerable application instance.\nPost-exploitation impact includes arbitrary code execution, unauthorized data access, potential lateral movement, and persistence establishment within the local environment."
}